Distributed fiber optic sensors are studied extensively, for monitoring abnormal events in continuous space, due to the advantages of immunity to electrical interference, non-conductivity and light weight. Moreover, the position of abnormal events, such as intrusions, could be determined directly without additional measurements. Among the various techniques, Sagnac interferometers prove to be promising for providing high sensitivity and large dynamic range in detecting intrusions. Two interference light beams are used which are naturally of equal optical path length in static status. When an intrusion occurs along the sensing fiber, the two light beams arrive at the intrusion position in different time and thus cause different phase changes induced by the intrusion. Analysis of the phase difference signal can predict the intrusion position, as well as the existence of the intrusion. As a Faraday rotator mirror (FRM) connected in the far-end of sensing fiber, both beams travel twice to the intrusion position after being reflected by the FRM. The propagation time interval T between the two interactions corresponds to the distance between the intrusion position and the far-end of sensing fiber Lx, which is further extracted as the localization of intrusion. Previously, the auto-correlation algorithm deals with the phase difference signal in the time domain and the null-frequency algorithm is used in frequency domain to calculate the distance. However the poor localization performance usually can not meet the requirement in high-quality monitoring applications. To determine the position of an intrusion effectively and accurately, the localization algorithm which deals with the phase difference signal in cepstrum domain is proposed in this article. Inspired by the research on the pitch examination we first introduce the algorithm for intrusion localization. Through theoretical analysis, the phase difference signal can be regarded as the convolution of the original waveform of intrusion and the T-related transform function. By applying the fast Fourier transform to the logarithmic spectrum, the phase difference signal is changed into the cepstrum domain, where the original waveform of intrusion and the transform function behave differently and are separated. The propagation time interval T, as well as the distance Lx, can be directly acquired from the peak produced by the transform function. In addition, to overcome the roughness in localization resolution brought by down-sampling of the phase difference signal, the decimator factor is scanned from 30 to 50 for multi-resolution localization at an original sampling rate 4 million/s-1. Besides the basic peak, high order peaks also emerge in the cepstrum in high signal-noise-ratio condition, which can also be used for localization. Since the localizations from different decimator factor and different peaks spread around the actual distance, an average of all reasonable localizations is calculated as the ultimate localization result for the intrusion. Firstly in experiments, intrusions occurring at a position 40.498 km are produced for the verification of the algorithm. The localizations are 40.489, 40.515 and 40.487 km, with localization errors as small as 9, 17 and 11 m respectively. Intrusions at different positions are tested and also correctly localized. For comparison, the standard deviations of localization error are respectively 695 m and 118 m for the auto-correlation algorithm and the null frequency algorithm, which are 58 times and 10 times of the result 12 m, which is obtained by the proposed cepstrum algorithm. The performance suggests promise to achieve better localization in practical applications.